The invention is related to the field of interactive debuggers for computer operating systems. In particular, the invention is related to the field of automatic symbol file library management and symbol resolution for symbolic kernel debuggers.
Many modern computer systems, including their resident operating systems and application programs have software bugs, or may have or develop other problems that cause maloperation. When maloperation occurs, it is desirable to identify any causative bugs or other problems so that repairs may be made to prevent future maloperation. Symbolic debuggers may be used by trained service personnel to examine variables of a maloperating computer system to help those personnel identify any causative bug or other problem.
Software bugs may exist in the operating system itself or in application programs. Viruses may enter the system and cause various levels of damage, leading to maloperation. Other problems that can cause maloperation include hardware defects, malfunctions of attached devices and networked computer systems, and maliciously or accidentally incorrect user input.
Debugging is often an iterative process of information gathering, making changes or performing other experiments, and testing. A symbolic debugger is a tool highly useful for at least the information gathering phase of this process, and occasionally useful for performing experiments and testing.
Symbolic kernel debuggers are symbolic debuggers having command sets and functions particularly suited to solving software bugs and problems associated with an operating system kernel or software drivers, such as input/output device drivers that run in kernel mode.
Symbolic kernel debuggers are often used to diagnose intermittent bugs in systems. Debugging intermittent problems requires that the failure state of the intermittent bug be reproduced, then the debugger may be used to examine information relevant to the bug. Reproducing intermittent bugs can be difficult and time consuming, sometimes requiring extensive repetition of test sequences to induce the failure state.
Symbolic debuggers, including symbolic kernel debuggers, typically incorporate a collection driver, a user interface, and a symbol resolution system.
The symbol resolution system reads a module-specific symbol file, typically generated by an assembler, compiler or linker when the module was created, to obtain a list of known symbols and relative or absolute addresses corresponding to those symbols. The symbol resolution system uses this list to translate symbolic requests by service personnel into memory addresses having variables to be read or function entry points to be called or intercepted. The symbol file may also specify a variable type associated with each symbol, which may control the way the user interface displays memory data.
Symbolic kernel debuggers may have the ability to parse system information, such as process lists and input/output buffers and to display relevant information. The symbol resolution system is often used by these debuggers to locate those lists and buffers since those lists and buffers may appear at different locations in memory for each version of the kernel or driver software.
It is essential that the version of the symbol file used by the symbol resolution system correspond to the version of the module running on the machine being debugged. If this is not the case, the debugger may read different locations than those intended, which can result in user confusion or a crashed debugger. Since operating modules are updated frequently, with service packs and in-line updates as well as with new operating system releases, locating, storing, and ensuring use of the correct symbol file can be a difficult exercise. Kernel-mode driver modules may also be released, patched, and updated, by hardware vendors; further complicating the logistical problem of ensuring use of the correct symbol file.
The collection driver typically gathers data as requested by service personnel, and, may, but need not, also have the ability to alter selected memory locations. The collection driver runs on the target machine, the machine being diagnosed. Some symbolic kernel debuggers are known to utilize a serial port of the target machine to communicate with a diagnosis machine upon which runs the user interface and symbol resolution system.
The user interface typically interfaces the collection driver and the symbol resolution system to a keyboard and display for interaction with service personnel users. The user interface may include system-specific code for reading linked-lists, including process lists, and displaying information from those lists to the user. Extraction of data from linked lists typically requires multiple calls from the user interface to the collection driver.
When an operating system runs on a machine, it is known that many operating system variables and data structures change as the system runs. Many of these data structures are of length greater than the word length of the machine; changes made to these structures must take place over several processor operations. If these data structures are examined by a debugger after the first operation of a change, but before the last operation of the change, the data captured or viewed by the debugger may not accurately reflect the state of the system. Similarly, if a debugger begins to view or capture a data structure prior to a change, but completes capture after the change, the data captured or viewed will be incoherent in that it does not accurately reflect the state of the system.
Incoherent data may cause confusion to service personnel attempting to interpret it. Since no indication of incoherency exists, it can be difficult to determine whether a problem indicated by the data is because the data is incoherent, or because the data indicates a problem with the system. Incoherent data may cause a debugger to display erroneous information. If incoherent data is followed as part of a linked list, the debugger may crash or attempt an illegal operation. For example, if links of a doubly linked list are examined after update to the forward links, but before update to the reverse links, the reverse links are incoherent and could result in a debugger crash if the debugger follows them. Debugger crashes may not only require that the debugger be restarted, but may require extensive work to reproduce the failure state of an intermittent bug.
It is desirable that captured data accurately reflect system state, or be xe2x80x9ccoherent,xe2x80x9d so that service personnel may diagnose the system without confusion, wasted effort following false leads, and without losing time to restarting crashed debuggers and reproducing bugs.
Some existing symbolic kernel debuggers ignore the problem of incoherent data. A debugger believed to ignore incoherency when taking a system snapshot is MICROSOFTi386KD(copyright) running under LiveKD by SysInternals, as distributed with the book: Inside WINDOWS 2000(copyright) 3xe2x80x2d ed. by David Solomon and Mark Russiovich, MICROSOFT(copyright) Press, 2000. Other debuggers such as MICROSOFT""S(copyright) i386KD without LiveKD enforce partial coherency by stopping execution of all programs, except for the debugger, on the target machine until debugging is complete. Stopping execution renders the target machine temporarily unusable, disrupting any real-time control functions or network services provided by that machine. Stopping execution prevents the operating system from making changes to data structures while the debugger is capturing or displaying those structures thereby preventing apparent incoherency resulting from updates to these structures as the debugger is reading them. Unless execution is stopped at a time when no changes to data structures are in progress, some incoherency may, however, exist.
It can be useful to obtain a snapshot of coherent state information about a system, allow that system to continue execution for some time, and obtain a second snapshot from that system. This permits service personnel to observe how the system state changes with time, which can yield useful clues about system bugs and other problems. In particular, multiple snapshots can be useful in identifying memory and resource leaks and performance problems.
Linked lists may be used by an operating system to store information about processes. It is known that WINDOWS NT(copyright) 4.0 and WINDOWS 2000(copyright) store process information in a linked process list. Each node of this list may incorporate a further linked thread list as well as additional information about the process that may be useful in debugging a system. For example, in addition to pointers to a thread list, a process list node may include process,name, execution priority and execution privileges.
Each node of the thread list contains list pointers to security tokens, context switches, I/O request lists, and wait blocks that can be of interest to service personnel investigating a software bug or other problem. Each node of the thread list of a process node may be linked to additional linked lists of the system.
MICROSOFT(copyright) Kernel Debugger i386KD (KD) is a symbolic debugger tailored for WINDOWS NT(copyright) and WINDOWS 2000(copyright) kernel and kernel-mode driver debugging. KD is designed for operation through a serial port of a target machine. Two machines are required, the target machine on which the system being debugged is located, having a collection driver, and an analysis machine having a symbol resolution system and a user interface. Symbol files matching the system being debugged must be present on the analysis machine. Matching symbol files are not automatically located although they are verified as correctly matching the target system. When KD is in use, all other threads on the target machine are stopped until debugging is complete, severely impacting operation of that machine. KD can, however, alter system variables and allow the system to resume operation when deugging is complete. having a collection driver, and an analysis machine having a symbol resolution system and a user interface. Symbol files matching the system being debugged must be present on the analysis machine. Matching symbol files are not automatically located although they are verified as correctly matching the target system. When KD is in use, all other threads on the target machine are stopped until debugging is complete, severely impacting operation of that machine. KD can, however, alter system variables and allow the system to resume operation when debugging is complete.
Given the many kernel and kernel-mode driver executable file updates released each year for each actively supported operating system and the many available hardware drivers, ensuring availability and use of the correct matching symbol files with a kernel debugger is difficult.
A network-aware, symbolic kernel debugger has been prepared. A local debugger embodiment has a collection driver, user interface, and symbol resolution system all running on the target machine. A remote debugger embodiment has the collection driver on the target machine, with the symbol resolution system and user interface on an analysis machine. A central symbol library debugger embodiment has the collection driver on the target machine, the user interface on an analysis machine, and the symbol files of the symbol resolution system on a symbol reference machine.
It has been found that most xe2x80x9clocked-upxe2x80x9d WINDOWS NT(copyright) and WINDOWS 2000(copyright) systems have problems with one or more of their keyboard, mouse, and display subsystems, but can still communicate over their network port. On these systems, insufficient virtual memory can prevent users from logging in on the keyboard and display, but network communications may still operate. The remote and central symbol library embodiments take advantage of this fact by using the network port of the target machine for communications between the analysis machine and the collection driver of the target machine.
The user interface is modular. It has a common framework and command line interpreter suitable for debugging several different operating systems on several different platforms, with one or more command plug-ins each suitable for debugging one specific operating system. Each command plug-in has operating system-specific knowledge and related commands. This knowledge includes by way of example and not of limitation knowledge of the format of each node of, and the root symbol name of, the process list. These commands include, for example, commands to display processes, with names, and the threads linked to those processes.
The symbol resolution system of the symbolic kernel debugger has a library of symbol files. This library contains symbol files suitable for several operating system versions that could be found on a target machine. The symbol resolution system automatically identifies the operating system version present on the target machine and locates appropriate symbol files in its library.
The collection driver of the symbolic kernel debugger is operating system specific. It is capable of taking snapshots of the target machine system state according to an input record list provided by the user interface command plug-in. Coherency of each snapshot is enforced through use of an operating system call to suspend execution of all processes and threads other than the collection driver itself for the time it takes to capture the snapshot. After the snapshot is collected, the suspended processes and threads are restarted so that operation can continue. This frequently permits capture of snapshots without visible disruption of system operation.
The foregoing and other features, utilities and advantages of the invention will be apparent from the following more particular description of a preferred embodiment of the invention as illustrated in the accompanying drawings.